IBM Planning Analytics 2.0/2.1 MongoDB Unauth Access Vulnerability
CVE-2024-35143 Published on August 4, 2024

IBM Planning Analytics Local missing authentication
IBM Planning Analytics Local 2.0 and 2.1 connects to a MongoDB server. MongoDB, a document-oriented database system, is listening on the remote port, and it is configured to allow connections without password authentication. A remote attacker can gain unauthorized access to the database. IBM X-Force ID: 292420.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2024-35143 can be exploited with local system access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
LOCAL
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Type

Missing Authentication for Critical Function

The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.


Products Associated with CVE-2024-35143

Want to know whenever a new CVE is published for IBM products? stack.watch will email you.

IBM Planning Analytics Workspace
 
IBM Planning Analytics Local
 
IBM Planning Analytics
 

Affected Versions

IBM Planning Analytics Local Version 2.0, 2.1 is affected by CVE-2024-35143

Exploit Probability

EPSS
0.09%
Percentile
24.67%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.